AI governance and compliance for cybersecurity and MDR: the regulatory perimeter inside which AI-driven security operations and continuously-retraining detection now operate.
Every framework below is enforceable today or about to be. Velma evidence is the format both sides expect.
Sorted by soonest deadline first.
DoD contractors handling Controlled Unclassified Information must achieve Level 3 certification, with continuous monitoring and per-decision evidence for any AI-driven security controls in the boundary.
Phase 3 of the CMMC program (Level 3, higher-assurance) begins 2027-11-10 under the final 48 CFR / DFARS rule. AI-driven security controls in the boundary need per-decision evidence.
Threat-detection, biometric-access, and critical-infrastructure security AI classified high-risk must ship with documented risk management, automatic record-keeping, human oversight, and regulator-readable audit trails.
Standalone systems 2 Dec 2027; embedded systems (XDR / EDR / MDR platforms) 2 Aug 2028 under the Digital Omnibus on AI. Fines up to 7% of global turnover. The audit-format gap is the per-decision record runtime governance closes.
The examiner can cite any of these on first request.
Public companies must disclose material cybersecurity incidents within four business days on Form 8-K, with annual disclosure of governance and risk-management processes including AI-driven security controls.
In force. The four-day clock is unforgiving when the decision graph that produced the response is not reproducible. Audit-chain governance closes the materiality-attribution gap.
Five stages. The evidence artifact. Isometric DFD-0.
Formal safety models, ODD, assurance cases, reviewer briefs.
How we are set up and why the trust structure matters.
Direct line to the inventor. No demo, no deck.
Thirty minutes. Architecture, not sales. On the regulatory surface you already know.
